<!doctype html>
<html class="no-js" lang="en">
  <head>
    <meta charset="utf-8" />
    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
    <title>
    
  natgateway功能项目 - NeilBlog
  
  </title>
  
  
  <link href="atom.xml" rel="alternate" title="NeilBlog" type="application/atom+xml">
    <link rel="stylesheet" href="asset/css/foundation.min.css" />
    <link rel="stylesheet" href="asset/css/docs.css" />
    <script src="asset/js/vendor/modernizr.js"></script>
    <script src="asset/js/vendor/jquery.js"></script>
  <script src="asset/highlightjs/highlight.pack.js"></script>
  <link href="asset/highlightjs/styles/github.css" media="screen, projection" rel="stylesheet" type="text/css">
  <script>hljs.initHighlightingOnLoad();</script>
<script type="text/javascript">
  function before_search(){
    var searchVal = 'site: ' + document.getElementById('search_input').value;
    document.getElementById('search_q').value = searchVal;
    return true;
  }
</script>
  </head>
  <body class="antialiased hide-extras">
    
    <div class="marketing off-canvas-wrap" data-offcanvas>
      <div class="inner-wrap">


<nav class="top-bar docs-bar hide-for-small" data-topbar>


  <section class="top-bar-section">
  <div class="row">
      <div style="position: relative;width:100%;"><div style="position: absolute; width:100%;">
        <ul id="main-menu" class="left">
        
        <li id=""><a target="self" href="index.html">Home</a></li>
        
        <li id=""><a target="_self" href="archives.html">Archives</a></li>
        
        </ul>

        <ul class="right" id="search-wrap">
          <li>
<form target="_blank" onsubmit="return before_search();" action="https://google.com/search" method="get">
    <input type="hidden" id="search_q" name="q" value="" />
    <input tabindex="1" type="search" id="search_input"  placeholder="Search"/>
</form>
</li>
          </ul>
      </div></div>
  </div>
  </section>

</nav>

        <nav class="tab-bar show-for-small">
  <a href="javascript:void(0)" class="left-off-canvas-toggle menu-icon">
    <span> &nbsp; NeilBlog</span>
  </a>
</nav>

<aside class="left-off-canvas-menu">
      <ul class="off-canvas-list">
        
        <li><a target="self" href="index.html">Home</a></li>
        
        <li><a target="_self" href="archives.html">Archives</a></li>
        

    <li><label>Categories</label></li>

        
            <li><a href="Python.html">Python</a></li>
        
            <li><a href="opentstack-neutron.html">opentstack-neutron</a></li>
        
            <li><a href="%E6%8A%80%E6%9C%AF%E5%91%A8%E8%BE%B9.html">技术周边</a></li>
        
            <li><a href="%E9%A1%B9%E7%9B%AE%E7%AC%94%E8%AE%B0.html">项目笔记</a></li>
         

      </ul>
    </aside>

<a class="exit-off-canvas" href="#"></a>


        <section id="main-content" role="main" class="scroll-container">
        
       

 <script type="text/javascript">
  $(function(){
    $('#menu_item_index').addClass('is_active');
  });
</script>
<div class="row">
  <div class="large-8 medium-8 columns">
      <div class="markdown-body article-wrap">
       <div class="article">
          
          <h1>natgateway功能项目</h1>
     
        <div class="read-more clearfix">
          <span class="date">2019/6/27</span>

          <span>posted in&nbsp;</span> 
          
              <span class="posted-in"><a href='%E9%A1%B9%E7%9B%AE%E7%AC%94%E8%AE%B0.html'>项目笔记</a></span>
           
         
          <span class="comments">
            

            
          </span>

        </div>
      </div><!-- article -->

      <div class="article-content">
      <ul>
<li>
<a href="#toc_0">整体框架图</a>
</li>
<li>
<a href="#toc_1">natgateway功能方案</a>
<ul>
<li>
<a href="#toc_2">natgateway neutron plugin实现</a>
</li>
<li>
<a href="#toc_3">natgateway agent实现</a>
<ul>
<li>
<a href="#toc_4">snat功能实现</a>
<ul>
<li>
<a href="#toc_5">snat功能验证</a>
<ul>
<li>
<a href="#toc_6">删除默认网关配置snat验证</a>
</li>
<li>
<a href="#toc_7">snat与eip共存验证</a>
</li>
<li>
<a href="#toc_8">snat与租管互通验证</a>
</li>
</ul>
</li>
</ul>
</li>
<li>
<a href="#toc_9">natgateway agent snat功能接口</a>
</li>
<li>
<a href="#toc_10">dnat功能实现</a>
<ul>
<li>
<ul>
<li>
<a href="#toc_11">验证eip与dnat共存情况下,dnat功能是否可用</a>
</li>
<li>
<a href="#toc_12">验证snat与dnat共存情况下，dnat功能是否可用</a>
</li>
<li>
<a href="#toc_13">租管互通情况下，dnat功能是否可用</a>
</li>
</ul>
</li>
</ul>
</li>
<li>
<a href="#toc_14">natgateway agent dnat功能接口</a>
</li>
</ul>
</li>
</ul>
</li>
</ul>


<h2 id="toc_0">整体框架图</h2>

<p><img src="media/15616076768930/15616234281714.jpg" alt=""/></p>

<h2 id="toc_1">natgateway功能方案</h2>

<ul>
<li>natgateway功能上线之后，将会裁掉默认网关功能，即上线后再创建VPC，则VPC下的vm在未购买eip、snat、dnat的情况下是不能访问外网或者从外网访问的。</li>
<li>关于nat功能上线时，禁止VPC默认网关生效的ACL规则由VCFC下发配置时生效。</li>
<li>为满足租管互通需求，VCFC会在VPC下的默认网关对应的ACL规则添加一条rule即：允许目的ip地址为cloudos地址的报文通过，即允许访问外网。</li>
</ul>

<h3 id="toc_2">natgateway neutron plugin实现</h3>

<ol>
<li>neutron提供PCO调用接口，完成natgatewey的逻辑处理</li>
<li>neutron部分代码需要维护eip与内网ip的关系，存储到neutron数据库</li>
<li><strong>neutron维护nat group索引 16385~65535, VCFC维护 0~16384</strong></li>
</ol>

<h3 id="toc_3">natgateway agent实现</h3>

<ul>
<li>natgateway agent采用脚本的方式实现，即通过脚本向FW下发相关的snat和dnat配置</li>
<li>snat配置能够支持VPC下某个子网能够访问外网</li>
<li>dnat不支持指定协议，所以目前配置支持tcp、udp指定外网地址与端口号与内网地址端口号的映射</li>
</ul>

<h4 id="toc_4">snat功能实现</h4>

<ol>
<li><p>配置snat原则及命令：</p>
<ul>
<li>删除VPC下默认网关ACL对应的permit规则<em>由VCFC创建VPC时配置</em></li>
<li>添加一条ACL规则和一个nat地址组配置，用于存放外网地址信息</li>
<li>在外网接口上将ACL规则与nat地址组规则通过nat outbound绑定</li>
<li>为了区分SDN下发配置与脚本下发配置区别，脚本下载的ACL和nat group规则前缀</li>
</ul>
<pre><code class="language-text">    SDN_ADDR = &#39;UNI_NEUTRON_ADDR_&#39;
    SDN_NAT_ACL = &#39;UNI_NEUTRON_NAT_ACL_&#39;
</code></pre>
<ul>
<li><strong>名称前缀要的字母序列要在默认网关之后，详见snat与租管互通验证</strong></li>
</ul></li>
</ol>

<h5 id="toc_5">snat功能验证</h5>

<h6 id="toc_6">删除默认网关配置snat验证</h6>

<ul>
<li><strong>默认网关删除VM不能访问外网，配置snat能够访问外网</strong></li>
<li>创建一个VPC，添加一个vm，vm能够访问外网。</li>
<li>将默认网关的ACL规则设置为deny,vm不能访问外网</li>
</ul>

<pre><code class="language-text">H3C-acl-ipv4-adv-SDN_NAT_ACL_6c42qr08ji88or3pejd7jssnpc]rule 10000 deny ip vpn-instance 6c42qr08ji88or3pejd7jssnpc
The rule was edited successfully.
[H3C-acl-ipv4-adv-SDN_NAT_ACL_6c42qr08ji88or3pejd7jssnpc]dis th
#
acl advanced name SDN_NAT_ACL_6c42qr08ji88or3pejd7jssnpc
description SDN_ACL_
rule 10000 deny ip vpn-instance 6c42qr08ji88or3pejd7jssnpc
#
return
此时VM 192.168.5.3 地址不能访问外网
</code></pre>

<ul>
<li> 新增一条ACL规则，指定192.168.5.0网段能够放行</li>
</ul>

<pre><code class="language-text">[H3C]acl advanced name SDN_NAT_ACL_6c42qr08ji88or3pejd7jssnpc_1
[H3C-acl-ipv4-adv-SDN_NAT_ACL_6c42qr08ji88or3pejd7jssnpc_1]rule 10001 permit ip vpn-instance 6c42qr08ji88or3pejd7jssnpc source 192.168.5.0 0.0.0.255
[H3C-acl-ipv4-adv-SDN_NAT_ACL_6c42qr08ji88or3pejd7jssnpc_1]dis th
#
acl advanced name SDN_NAT_ACL_6c42qr08ji88or3pejd7jssnpc_1
rule 10001 permit ip vpn-instance 6c42qr08ji88or3pejd7jssnpc source 192.168.5.0 0.0.0.255
#
Return
</code></pre>

<ul>
<li>新增一个nat group（相当于购买一个EIP信息） </li>
</ul>

<pre><code class="language-text">H3C]nat address-group 50 name SDN_ADDR_6c42qr08ji88or3pejd7jssnpc_1
[H3C-address-group-50-SDN_ADDR_6c42qr08ji88or3pejd7jssnpc_1]addr
[H3C-address-group-50-SDN_ADDR_6c42qr08ji88or3pejd7jssnpc_1]address 10.0.46.100 10.0.46.100
</code></pre>

<ul>
<li>将nat group与acl规则绑定并添加到对应的出接口下</li>
</ul>

<pre><code class="language-text">[[H3C-Route-Aggregation2]nat outbound name SDN_NAT_ACL_6c42qr08ji88or3pejd7jssnpc_1 address-group name SDN_ADDR_6c42qr08ji88or3pejd7jssnpc_1 vpn-instance externa
l_vpn
此时192.168.5.3 VM能够ping通外网。
</code></pre>

<h6 id="toc_7">snat与eip共存验证</h6>

<ul>
<li><strong>VM配置EIP功能下，vm能够访问外网，且通过EIP对应的地址转换出去，不会转成snat的eip地址</strong></li>
<li>整体VPC相关配置</li>
</ul>

<pre><code class="language-text">nat static outbound 192.168.6.5 vpn-instance 6b825g0sv08dcrt0q1gd16bl6o 103.36.28.146 vpn-instance external_vpn acl name SDN_NAT_ACL_6b825g0sv08dcrt0q1gd16bl6o_eip reversible
 ip binding vpn-instance 6b825g0sv08dcrt0q1gd16bl6o
  rule 37 pass vrf 6b825g0sv08dcrt0q1gd16bl6o
 rule 0 pass vrf 6b825g0sv08dcrt0q1gd16bl6o counting
 rule 60000 pass vrf 6b825g0sv08dcrt0q1gd16bl6o counting
 rule 0 pass vrf 6b825g0sv08dcrt0q1gd16bl6o counting
 rule 60000 pass vrf 6b825g0sv08dcrt0q1gd16bl6o counting
 rule 0 pass vrf 6b825g0sv08dcrt0q1gd16bl6o counting
 import ip 192.168.6.0 24 vpn-instance 6b825g0sv08dcrt0q1gd16bl6o
 ip route-static vpn-instance 6b825g0sv08dcrt0q1gd16bl6o 0.0.0.0 0 vpn-instance external_vpn 10.251.179.254 description SDN_ROUTE
 ip route-static vpn-instance 6b825g0sv08dcrt0q1gd16bl6o 192.168.6.0 24 10.251.164.81 description SDN_ROUTE
acl advanced name SDN_NAT_ACL_6b825g0sv08dcrt0q1gd16bl6o_eip
acl advanced name SDN_NAT_ACL_6b825g0sv08dcrt0q1gd16bl6o_snat
acl advanced name SDN_NAT_ACL_6b825g0sv08dcrt0q1gd16bl6o???nat
    
nat address-group 500 name SDN_ADDR_6b825g0sv08dcrt0q1gd16bl6o_snat
</code></pre>

<ul>
<li>配置默认网关情况下ping 114.114.114.114 能够正常ping通</li>
</ul>

<pre><code class="language-text">acl advanced name SDN_NAT_ACL_6b825g0sv08dcrt0q1gd16bl6o
 rule 10000 permit ip vpn-instance 6b825g0sv08dcrt0q1gd16bl6o
    
nat outbound name SDN_NAT_ACL_6b825g0sv08dcrt0q1gd16bl6o address-group name SDN_ADDR_6b825g0sv08dcrt0q1gd16bl6o vpn-instance external_vpn
    
nat address-group 17 name SDN_ADDR_6b825g0sv08dcrt0q1gd16bl6o
 address 103.36.30.4 103.36.30.4
</code></pre>

<p>转化成默认网关地址<br/>
<img src="media/15616076768930/15616154004930.jpg" alt=""/></p>

<ul>
<li>配置默认网关和VM绑定EIP后能够正常ping通114.114.114.114，nat转换地址为eip地址</li>
</ul>

<pre><code class="language-text">acl advanced name SDN_NAT_ACL_6b825g0sv08dcrt0q1gd16bl6o_eip
 rule 10000 permit ip vpn-instance 6b825g0sv08dcrt0q1gd16bl6o

nat static outbound 192.168.6.5 vpn-instance 6b825g0sv08dcrt0q1gd16bl6o 103.36.28.146 vpn-instance external_vpn acl name SDN_NAT_ACL_6b825g0sv08dcrt0q1gd16bl6o_eip reversible
</code></pre>

<p><img src="media/15616076768930/15616155237516.jpg" alt=""/></p>

<ul>
<li>配置默认网关为deny或删除acl，且配置eip，能通，转化地址为eip地址</li>
</ul>

<pre><code class="language-text">#
acl advanced name SDN_NAT_ACL_6b825g0sv08dcrt0q1gd16bl6o
 description SDN_ACL_
 rule 10000 deny ip vpn-instance 6b825g0sv08dcrt0q1gd16bl6o
#

[H3C-acl-ipv4-adv-SDN_NAT_ACL_6b825g0sv08dcrt0q1gd16bl6o]dis this
#
acl advanced name SDN_NAT_ACL_6b825g0sv08dcrt0q1gd16bl6o
 description SDN_ACL_
#
return
</code></pre>

<p><img src="media/15616076768930/15616155940120.jpg" alt=""/></p>

<ul>
<li>默认网关删除或deny且删除eip配置，配置snat功能，能够ping通，转换地址为snat地址</li>
</ul>

<pre><code class="language-text">#
nat address-group 500 name SDN_ADDR_6b825g0sv08dcrt0q1gd16bl6o_snat
 address 10.0.46.100 10.0.46.100
#
return
[H3C-acl-ipv4-adv-SDN_NAT_ACL_6b825g0sv08dcrt0q1gd16bl6o_snat]dis this
#
acl advanced name SDN_NAT_ACL_6b825g0sv08dcrt0q1gd16bl6o_snat
 rule 10000 permit ip vpn-instance 6b825g0sv08dcrt0q1 source 192.168.6.0 0.0.0.255
#
return
    
nat outbound name SDN_NAT_ACL_6b825g0sv08dcrt0q1gd16bl6o_snat address-group name SDN_ADDR_6b825g0sv08dcrt0q1gd16bl6o_snat vpn-instance external_vpn
    
[H3C-acl-ipv4-adv-SDN_NAT_ACL_6b825g0sv08dcrt0q1gd16bl6o]dis this
#
acl advanced name SDN_NAT_ACL_6b825g0sv08dcrt0q1gd16bl6o
 description SDN_ACL_
#
Return
    
[H3C-acl-ipv4-adv-SDN_NAT_ACL_6b825g0sv08dcrt0q1gd16bl6o_eip]dis this
#
acl advanced name SDN_NAT_ACL_6b825g0sv08dcrt0q1gd16bl6o_eip
#
return
</code></pre>

<p><img src="media/15616076768930/15616156491411.jpg" alt=""/></p>

<ul>
<li>默认网关删除或deny，配置eip地址，配置snat功能，转换地址为eip地址</li>
</ul>

<pre><code class="language-text">#
nat address-group 500 name SDN_ADDR_6b825g0sv08dcrt0q1gd16bl6o_snat
 address 10.0.46.100 10.0.46.100
#
return
[H3C-acl-ipv4-adv-SDN_NAT_ACL_6b825g0sv08dcrt0q1gd16bl6o_snat]dis this
#
acl advanced name SDN_NAT_ACL_6b825g0sv08dcrt0q1gd16bl6o_snat
 rule 10000 permit ip vpn-instance 6b825g0sv08dcrt0q1 source 192.168.6.0 0.0.0.255
#
return
    
nat outbound name SDN_NAT_ACL_6b825g0sv08dcrt0q1gd16bl6o_snat address-group name SDN_ADDR_6b825g0sv08dcrt0q1gd16bl6o_snat vpn-instance external_vpn
    
删除默认网关配置
[H3C-acl-ipv4-adv-SDN_NAT_ACL_6b825g0sv08dcrt0q1gd16bl6o]dis this
#
acl advanced name SDN_NAT_ACL_6b825g0sv08dcrt0q1gd16bl6o
 description SDN_ACL_
#
return
</code></pre>

<p><img src="media/15616076768930/15616158017702.jpg" alt=""/></p>

<h6 id="toc_8">snat与租管互通验证</h6>

<ul>
<li><strong>配置租管互通出方向走默认网关，snat干掉默认网关之后会导致租管互通不通，解决方案如下，后续为验证过程</strong>
<ul>
<li>目前解决方式：在默认网关配置rule，允许目的ip地址为cloudos地址（内网eip地址）的报文通过</li>
<li>最终解决方案：重新配置一条ACL与nat group，ACL下的rule为允许目的ip地址为cloudos地址（内网eip地址）的报文通过</li>
</ul></li>
<li>  配置了eip也配置了租管互通的100.64网段的网关信息，配置如下：</li>
</ul>

<pre><code class="language-text">nat address-group 501 name SDN_ADDR_6b825g0sv08dcrt0q1gd16bl6o_zght
 nat static outbound 192.168.6.5 vpn-instance 6b825g0sv08dcrt0q1gd16bl6o 103.36.28.146 vpn-instance external_vpn acl name SDN_NAT_ACL_6b825g0sv08dcrt0q1gd16bl6o_eip reversible
nat outbound name SDN_NAT_ACL_6b825g0sv08dcrt0q1gd16bl6o_snat address-group name SDN_ADDR_6b825g0sv08dcrt0q1gd16bl6o_snat vpn-instance external_vpn
 nat outbound name SDN_NAT_ACL_6b825g0sv08dcrt0q1gd16bl6o_zght address-group name SDN_ADDR_6b825g0sv08dcrt0q1gd16bl6o_zght vpn-instance external_vpn
ip route-static vpn-instance 6b825g0sv08dcrt0q1gd16bl6o 192.168.6.0 24 10.251.164.81 description SDN_ROUTE
acl advanced name SDN_NAT_ACL_6b825g0sv08dcrt0q1gd16bl6o_eip
 rule 10000 permit ip vpn-instance 6b825g0sv08dcrt0q1gd16bl6o
acl advanced name SDN_NAT_ACL_6b825g0sv08dcrt0q1gd16bl6o_snat
 rule 10000 permit ip vpn-instance 6b825g0sv08dcrt0q1gd16bl6o source 192.168.6.0 0.0.0.255
acl advanced name SDN_NAT_ACL_6b825g0sv08dcrt0q1gd16bl6o_zght
 rule 10000 permit ip vpn-instance 6b825g0sv08dcrt0q1gd16bl6o destination 100.64.9.0 0.0.0.
</code></pre>

<p>此时显示的IP地址转换出来为EIP的地址即103.36.28.146<br/>
<img src="media/15616076768930/15616159813542.jpg" alt=""/></p>

<ul>
<li>  未配置eip的情况下租管互通的地址转换如下图：<br/>
租管互通配置的acl规则只指定目的地址的情况下地址转换会被snat规则替代，如下：</li>
</ul>

<pre><code class="language-text">[H3C-acl-ipv4-adv-SDN_NAT_ACL_6b825g0sv08dcrt0q1gd16bl6o_eip]dis this
#
acl advanced name SDN_NAT_ACL_6b825g0sv08dcrt0q1gd16bl6o_eip
 rule 10000 deny ip vpn-instance 6b825g0sv08dcrt0q1gd16bl6o
#
return

#
nat address-group 501 name SDN_ADDR_6b825g0sv08dcrt0q1gd16bl6o_zght
 address 100.64.192.100 100.64.192.100
#
acl advanced name SDN_NAT_ACL_6b825g0sv08dcrt0q1gd16bl6o_zght
 rule 10000 permit ip vpn-instance 6b825g0sv08dcrt0q1gd16bl6o destination 100.64.9.0 0.0.0.
</code></pre>

<p>如上所示只指定了目的未指定源地址，则会出现转换成snat配置的那条规则：<br/>
<img src="media/15616076768930/15616164678217.jpg" alt=""/></p>

<ul>
<li>未配置eip的情况下租管互通的地址转换如下图：</li>
</ul>

<pre><code class="language-text">租管互通的acl规则配置：
#
acl advanced name SDN_NAT_ACL_6b825g0sv08dcrt0q1gd16bl6o_zght
 rule 10000 permit ip vpn-instance 6b825g0sv08dcrt0q1gd16bl6o source 192.168.6.0 0.0.0.255 destination 100.64.9.0 0.0.0.7
#

ip vpn-instance 6b825g0sv08dcrt0q1gd16bl6o
nat address-group 17 name SDN_ADDR_6b825g0sv08dcrt0q1gd16bl6o
nat address-group 500 name SDN_ADDR_6b825g0sv08dcrt0q1gd16bl6o_snat
nat address-group 501 name SDN_ADDR_6b825g0sv08dcrt0q1gd16bl6o_zght
 nat static outbound 192.168.6.5 vpn-instance 6b825g0sv08dcrt0q1gd16bl6o 103.36.28.146 vpn-instance external_vpn acl name SDN_NAT_ACL_6b825g0sv08dcrt0q1gd16bl6o_eip reversible
 ip binding vpn-instance 6b825g0sv08dcrt0q1gd16bl6o
 nat outbound name SDN_NAT_ACL_6b825g0sv08dcrt0q1gd16bl6o address-group name SDN_ADDR_6b825g0sv08dcrt0q1gd16bl6o vpn-instance external_vpn
 nat outbound name SDN_NAT_ACL_6b825g0sv08dcrt0q1gd16bl6o_snat address-group name SDN_ADDR_6b825g0sv08dcrt0q1gd16bl6o_snat vpn-instance external_vpn
 nat outbound name SDN_NAT_ACL_6b825g0sv08dcrt0q1gd16bl6o_zght address-group name SDN_ADDR_6b825g0sv08dcrt0q1gd16bl6o_zght vpn-instance external_vpn
 rule 37 pass vrf 6b825g0sv08dcrt0q1gd16bl6o
 rule 0 pass vrf 6b825g0sv08dcrt0q1gd16bl6o counting
 rule 60000 pass vrf 6b825g0sv08dcrt0q1gd16bl6o counting
 rule 0 pass vrf 6b825g0sv08dcrt0q1gd16bl6o counting
 rule 60000 pass vrf 6b825g0sv08dcrt0q1gd16bl6o counting
 rule 0 pass vrf 6b825g0sv08dcrt0q1gd16bl6o counting
 import ip 192.168.6.0 24 vpn-instance 6b825g0sv08dcrt0q1gd16bl6o
 ip route-static vpn-instance 6b825g0sv08dcrt0q1gd16bl6o 0.0.0.0 0 vpn-instance external_vpn 10.251.179.254 description SDN_ROUTE
 ip route-static vpn-instance 6b825g0sv08dcrt0q1gd16bl6o 192.168.6.0 24 10.251.164.81 description SDN_ROUTE
acl advanced name SDN_NAT_ACL_6b825g0sv08dcrt0q1gd16bl6o
acl advanced name SDN_NAT_ACL_6b825g0sv08dcrt0q1gd16bl6o_eip
 rule 10000 deny ip vpn-instance 6b825g0sv08dcrt0q1gd16bl6o
acl advanced name SDN_NAT_ACL_6b825g0sv08dcrt0q1gd16bl6o_snat
 rule 10000 permit ip vpn-instance 6b825g0sv08dcrt0q1gd16bl6o source 192.168.6.0 0.0.0.255
acl advanced name SDN_NAT_ACL_6b825g0sv08dcrt0q1gd16bl6o_zght
 rule 10000 permit ip vpn-instance 6b825g0sv08dcrt0q1gd16bl6o source 192.168.6.0 0.0.0.255 destination 100.64.9.0 0.0.0.7
</code></pre>

<p>snat规则不变同上,转换后地址如下图所示，仍然未转换到租管互通的100网段地址<br/>
<img src="media/15616076768930/15616165723606.jpg" alt=""/></p>

<ul>
<li>将租管互通的acl规则名称修改为在snat规则之上情况下测试结果。
<ul>
<li>如下配置，与3的唯一区别是outbound的ACL名称租管互通的名称排在SNAT的功能之前，此时租管互通的规则生效，如抓包结果所示转换为租管互通的100网段地址。</li>
</ul></li>
</ul>

<pre><code class="language-text">ip vpn-instance 6b825g0sv08dcrt0q1gd16bl6o
nat address-group 17 name SDN_ADDR_6b825g0sv08dcrt0q1gd16bl6o
nat address-group 500 name SDN_ADDR_6b825g0sv08dcrt0q1gd16bl6o_snat
nat address-group 501 name SDN_ADDR_6b825g0sv08dcrt0q1gd16bl6o_zght
 nat static outbound 192.168.6.5 vpn-instance 6b825g0sv08dcrt0q1gd16bl6o 103.36.28.146 vpn-instance external_vpn acl name SDN_NAT_ACL_6b825g0sv08dcrt0q1gd16bl6o_eip reversible
 ip binding vpn-instance 6b825g0sv08dcrt0q1gd16bl6o
 nat outbound name SDN_NAT_ACL_6b825g0sv08dcrt0q1gd16bl6o address-group name SDN_ADDR_6b825g0sv08dcrt0q1gd16bl6o vpn-instance external_vpn
 nat outbound name SDN_NAT_ACL_6b825g0sv08dcrt0q1gd16bl6o_azght address-group name SDN_ADDR_6b825g0sv08dcrt0q1gd16bl6o_zght vpn-instance external_vpn
 nat outbound name SDN_NAT_ACL_6b825g0sv08dcrt0q1gd16bl6o_snat address-group name SDN_ADDR_6b825g0sv08dcrt0q1gd16bl6o_snat vpn-instance external_vpn
 rule 37 pass vrf 6b825g0sv08dcrt0q1gd16bl6o
 rule 0 pass vrf 6b825g0sv08dcrt0q1gd16bl6o counting
 rule 60000 pass vrf 6b825g0sv08dcrt0q1gd16bl6o counting
 rule 0 pass vrf 6b825g0sv08dcrt0q1gd16bl6o counting
 rule 60000 pass vrf 6b825g0sv08dcrt0q1gd16bl6o counting
 rule 0 pass vrf 6b825g0sv08dcrt0q1gd16bl6o counting
 import ip 192.168.6.0 24 vpn-instance 6b825g0sv08dcrt0q1gd16bl6o
 ip route-static vpn-instance 6b825g0sv08dcrt0q1gd16bl6o 0.0.0.0 0 vpn-instance external_vpn 10.251.179.254 description SDN_ROUTE
 ip route-static vpn-instance 6b825g0sv08dcrt0q1gd16bl6o 192.168.6.0 24 10.251.164.81 description SDN_ROUTE
acl advanced name SDN_ADDR_6b825g0sv08dcrt0q1gd16bl6o_zght
acl advanced name SDN_NAT_ACL_6b825g0sv08dcrt0q1gd16bl6o
acl advanced name SDN_NAT_ACL_6b825g0sv08dcrt0q1gd16bl6o_azght
 rule 10000 permit ip vpn-instance 6b825g0sv08dcrt0q1gd16bl6o source 192.168.6.0 0.0.0.255 destination 100.64.9.0 0.0.0.7
acl advanced name SDN_NAT_ACL_6b825g0sv08dcrt0q1gd16bl6o_eip
 rule 10000 deny ip vpn-instance 6b825g0sv08dcrt0q1gd16bl6o
acl advanced name SDN_NAT_ACL_6b825g0sv08dcrt0q1gd16bl6o_snat
 rule 10000 permit ip vpn-instance 6b825g0sv08dcrt0q1gd16bl6o source 192.168.6.0 0.0.0.255
</code></pre>

<p><img src="media/15616076768930/15616166251616.jpg" alt=""/></p>

<h4 id="toc_9">natgateway agent snat功能接口</h4>

<ul>
<li><p>creat</p>
<ul>
<li>URL <a href="http://10.0.46.156:30458/snat/create">http://10.0.46.156:30458/snat/create</a></li>
<li>PUT 方法</li>
<li>JSON data:</li>
</ul>
<pre><code class="language-text">{
    &quot;vpn-instance&quot;: &quot;ly1234567890&quot;,<br/>
    &quot;eip&quot;: &quot;1.1.1.1&quot;,<br/>
    &quot;address-group&quot;: 65000,<br/>
    &quot;interfacename&quot;: &quot;Ten-GigabitEthernet1/2/1&quot;,<br/>
    &quot;subnet_array&quot;: [{&quot;ip&quot;: &quot;192.168.1.1&quot;, &quot;netmask&quot;: 24}]<br/>
}
</code></pre></li>
<li><p>delete</p>
<ul>
<li>URL <a href="http://10.0.46.156:30458/snat/delete">http://10.0.46.156:30458/snat/delete</a></li>
<li>PUT 方法</li>
<li>JSON </li>
</ul>
<pre><code class="language-text">{
    &quot;vpn-instance&quot;: &quot;ly1234567890&quot;,<br/>
    &quot;address-group&quot;: 65000,<br/>
    &quot;interfacename&quot;: &quot;Ten-GigabitEthernet1/2/1&quot;<br/>
}
</code></pre></li>
<li><p>update</p>
<ul>
<li>URL <a href="http://10.0.46.156:30458/snat/update">http://10.0.46.156:30458/snat/update</a></li>
<li>PUT方法</li>
<li>JSON</li>
</ul>
<pre><code class="language-text">{
    &quot;vpn-instance&quot;: &quot;ly1234567890&quot;,<br/>
    &quot;eip&quot;: &quot;1.1.1.2&quot;,<br/>
    &quot;address-group&quot;: 65000,<br/>
    &quot;interfacename&quot;: &quot;Ten-GigabitEthernet1/2/1&quot;,<br/>
    &quot;subnet_array&quot;: [{&quot;ip&quot;: &quot;192.168.2.0&quot;, &quot;netmask&quot;: 24},<br/>
    {&quot;ip&quot;: &quot;192.168.1.0&quot;, &quot;netmask&quot;: 24}]<br/>
}
</code></pre></li>
</ul>

<h4 id="toc_10">dnat功能实现</h4>

<p><strong>dnat功能即下发一条nat server规则即在防火墙上添加DNAT规则如下</strong></p>

<pre><code class="language-text">nat server protocol tcp global 100.64.192.11 54321 vpn-instance external_vpn inside 172.17.1.2 22 vpn-instance 1e54vevhk09j9qo6jdug4tlkgp
</code></pre>

<p>首先需要有一个非VPC网络能够访问VPC网络的环境。当前，在10.0.46.156上，已经存在可用网络，组网图如下：<br/>
<img src="media/15616076768930/15616167139442.jpg" alt=""/></p>

<p>如图所示：<br/>
Border-&gt;Switch属于非VPC网络<br/>
而Border-&gt;Spine属于VPC网络</p>

<p>此时在PC上通过ssh能够登录到VM172.17.1.2的设备上。<br/>
<img src="media/15616076768930/15616167914968.jpg" alt=""/><br/>
抓包如下：<br/>
<img src="media/15616076768930/15616168068085.jpg" alt=""/></p>

<h6 id="toc_11">验证eip与dnat共存情况下,dnat功能是否可用</h6>

<ul>
<li>通过CloudOS将VM绑定EIP(100.64.192.11)</li>
<li>下发命令配置DNAT功能(100.64.192.12:54321.  &lt;-&gt; 172.17.1.2:22)</li>
<li>查看ssh登录结果 </li>
<li><strong>EIP和dnat同时配置时，EIP和dnat均生效，均能访问对应内网服务</strong></li>
</ul>

<p><img src="media/15616076768930/15616168648356.jpg" alt=""/><br/>
<img src="media/15616076768930/15616168742201.jpg" alt=""/><br/>
<img src="media/15616076768930/15616168844698.jpg" alt=""/></p>

<ul>
<li>使用EIP地址也能ssh登录到VM ssh root@100.64.192.11</li>
</ul>

<p><img src="media/15616076768930/15616169156020.jpg" alt=""/></p>

<h6 id="toc_12">验证snat与dnat共存情况下，dnat功能是否可用</h6>

<ul>
<li>配置snat功能，未配置EIP功能</li>
<li>下发命令配置DNAT功能</li>
<li>查看ssh登录结果，通过VM ping外部PC地址
<ul>
<li>snat功能生效</li>
<li>dnat功能生效, 且eip功能失效</li>
<li><strong>snat与dnat不会相互影响，snat能够访问外网，dnat能够被外网访问指定端口</strong></li>
</ul></li>
</ul>

<p><img src="media/15616076768930/15616169845167.jpg" alt=""/><br/>
<img src="media/15616076768930/15616169901270.jpg" alt=""/><br/>
<img src="media/15616076768930/15616170452907.jpg" alt=""/></p>

<h6 id="toc_13">租管互通情况下，dnat功能是否可用</h6>

<ul>
<li>由于租管互通由VM-&gt;Cloudos走的是默认网关功能，与DNAT无关，顾不进行测试。</li>
</ul>

<h4 id="toc_14">natgateway agent dnat功能接口</h4>

<ul>
<li><p>create</p>
<ul>
<li>URL <a href="http://10.0.46.156:30458/dnat/create">http://10.0.46.156:30458/dnat/create</a></li>
<li>PUT 方法</li>
<li>JSON data</li>
</ul>
<pre><code class="language-text">{
    &quot;vpn-instance&quot;: &quot;ly1234567890&quot;,<br/>
    &quot;eip_port&quot;: {&quot;ip&quot;: &quot;192.168.1.1&quot;, &quot;port&quot;: 2222},<br/>
    &quot;ip_port&quot;: {&quot;ip&quot;: &quot;192.168.1.1&quot;, &quot;port&quot;: 2222},<br/>
    &quot;interfacename&quot;: &quot;Ten-GigabitEthernet1/2/1&quot;<br/>
}
</code></pre></li>
<li><p>delete</p>
<ul>
<li>URL <a href="http://10.0.46.156:30458/dnat/delete">http://10.0.46.156:30458/dnat/delete</a></li>
<li>PUT 方法</li>
<li>JSON data</li>
</ul>
<pre><code class="language-text">{
    &quot;vpn-instance&quot;: &quot;ly1234567890&quot;,<br/>
    &quot;eip_port&quot;: {&quot;ip&quot;: &quot;192.168.1.1&quot;, &quot;port&quot;: 2222},<br/>
    &quot;interfacename&quot;: &quot;Ten-GigabitEthernet1/2/1&quot;<br/>
} 
</code></pre></li>
<li><p>update</p>
<ul>
<li>URL <a href="http://10.0.46.156:30458/dnat/update">http://10.0.46.156:30458/dnat/update</a></li>
<li>PUT 方法</li>
<li>JSON data</li>
</ul>
<pre><code class="language-text">{
    &quot;vpn-instance&quot;: &quot;ly1234567890&quot;,<br/>
    &quot;eip_port_old&quot;: {&quot;ip&quot;: &quot;192.168.1.1&quot;, &quot;port&quot;: 3333},<br/>
    &quot;eip_port_new&quot;: {&quot;ip&quot;: &quot;192.168.1.1&quot;, &quot;port&quot;: 2222},<br/>
    &quot;ip_port&quot;: {&quot;ip&quot;: &quot;192.168.1.1&quot;, &quot;port&quot;: 2222},<br/>
    &quot;interfacename&quot;: &quot;Ten-GigabitEthernet1/2/1&quot;<br/>
}
</code></pre></li>
</ul>


    

      </div>

      <div class="row">
        <div class="large-6 columns">
        <p class="text-left" style="padding:15px 0px;">
      
          <a href="15616868047861.html" 
          title="Previous Post: ```">&laquo; ```</a>
      
        </p>
        </div>
        <div class="large-6 columns">
      <p class="text-right" style="padding:15px 0px;">
      
      </p>
        </div>
      </div>
      <div class="comments-wrap">
        <div class="share-comments">
          

          

          
        </div>
      </div>
    </div><!-- article-wrap -->
  </div><!-- large 8 -->




 <div class="large-4 medium-4 columns">
  <div class="hide-for-small">
    <div id="sidebar" class="sidebar">
          <div id="site-info" class="site-info">
            
                <h1>NeilBlog</h1>
                <div class="site-des"></div>
                <div class="social">











  <a target="_blank" class="rss" href="atom.xml" title="RSS">RSS</a>
                
              	 </div>
          	</div>

             

              <div id="site-categories" class="side-item ">
                <div class="side-header">
                  <h2>Categories</h2>
                </div>
                <div class="side-content">

      	<p class="cat-list">
        
            <a href="Python.html"><strong>Python</strong></a>
        
            <a href="opentstack-neutron.html"><strong>opentstack-neutron</strong></a>
        
            <a href="%E6%8A%80%E6%9C%AF%E5%91%A8%E8%BE%B9.html"><strong>技术周边</strong></a>
        
            <a href="%E9%A1%B9%E7%9B%AE%E7%AC%94%E8%AE%B0.html"><strong>项目笔记</strong></a>
         
        </p>


                </div>
              </div>

              <div id="site-categories" class="side-item">
                <div class="side-header">
                  <h2>Recent Posts</h2>
                </div>
                <div class="side-content">
                <ul class="posts-list">
	      
		      
			      <li class="post">
			        <a href="15623333744762.html">bytes/string转换</a>
			      </li>
		     
		  
		      
			      <li class="post">
			        <a href="15622929808447.html">netconf client通信框架</a>
			      </li>
		     
		  
		      
			      <li class="post">
			        <a href="15621228986145.html">devstack 安装openstack</a>
			      </li>
		     
		  
		      
			      <li class="post">
			        <a href="15620552731750.html">neutron agent 使用netconf向设备下发配置</a>
			      </li>
		     
		  
		      
			      <li class="post">
			        <a href="15620392963346.html">loggging模块</a>
			      </li>
		     
		  
		      
		  
		      
		  
		      
		  
		      
		  
		      
		   
		  		</ul>
                </div>
              </div>
        </div><!-- sidebar -->
      </div><!-- hide for small -->
</div><!-- large 4 -->

</div><!-- row -->

 <div class="page-bottom clearfix">
  <div class="row">
   <p class="copyright">Copyright &copy; 2015
Powered by <a target="_blank" href="http://www.mweb.im">MWeb</a>,&nbsp; 
Theme used <a target="_blank" href="http://github.com">GitHub CSS</a>.</p>
  </div>
</div>

        </section>
      </div>
    </div>

  
    

    <script src="asset/js/foundation.min.js"></script>
    <script>
      $(document).foundation();
      function fixSidebarHeight(){
        var w1 = $('.markdown-body').height();
          var w2 = $('#sidebar').height();
          if (w1 > w2) { $('#sidebar').height(w1); };
      }
      $(function(){
        fixSidebarHeight();
      })
      $(window).load(function(){
          fixSidebarHeight();
      });
     
    </script>

    
<script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/mathjax/2.7.1/MathJax.js?config=TeX-AMS-MML_HTMLorMML"></script><script type="text/x-mathjax-config">MathJax.Hub.Config({TeX: { equationNumbers: { autoNumber: "AMS" } }});</script>


  </body>
</html>
